PT-2014-7206 · Facebook · Facebook App+1

William Costa · Published 2014-09-15 · Updated 2024-08-06 · CVE-2014-6392

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Facebook app version 14.0 Facebook Messenger app version 10.0

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via a crafted filename extension that is improperly handled during MIME sniffing of chat traffic. The vendor disputes the significance of this report, citing that the user must accept an interstitial warning before the HTML file content is rendered, and the HTML content's origin is a sandbox domain.

Recommendations For Facebook app version 14.0, consider disabling the rendering of HTML file content from chat traffic until a patch is available. For Facebook Messenger app version 10.0, restrict the handling of crafted filename extensions to minimize the risk of exploitation.

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2014-6392

Affected Products

Facebook Messenger

Facebook App

References · 4

• https://nvd.nist.gov/vuln/detail/CVE-2014-6392 · Security Note
• http://seclists.org/fulldisclosure/2014/Sep/13 · Note
• https://t.me/cvenotify/89415 · Telegram Post
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6392 · Note